---
id: CVE-2026-118686
title: >-
  EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via
  Password-Redaction Regex
summary: >-
  EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service
  vulnerability in which the password-redaction regular expression applied
  during API error handling consumes excessive CPU on long request bodies.
  Unauthenticated r…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-1333
vendor: espocrm
product: espocrm
affected:
  - espocrm >= 10.0.0 < 10.0.8
  - espocrm < 9.3.11
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T18:59:55.556Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118686'
references:
  - url: 'https://github.com/espocrm/espocrm/security/advisories/GHSA-6pjq-v35w-jmjh'
    label: GitHub Security Advisory (GHSA-6pjq-v35w-jmjh)
  - url: >-
      https://www.vulncheck.com/advisories/espocrm-before-9.3.11-and-10.0.8-unauthenticated-denial-of-service-via-password-redaction-regex
    label: >-
      VulnCheck Advisory: EspoCRM before 9.3.11 and 10.0.8 Unauthenticated
      Denial of Service via Password-Redaction Regex
tags:
  - cve.org
epss: 0.00347
epssPercentile: 0.28248
ingestedAt: '2026-10-29T15:37:07.553Z'
---

## Overview

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

## Affected

- `espocrm >= 10.0.0 < 10.0.8`
- `espocrm < 9.3.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.